IT-12: Personnel Security (PS) Standard

Control:

Personnel Screening

Required for:

High

Moderate

Low

IU Implementation

Follow appropriate screening procedures for employees and part time employees (as set forth by the appropriate offices) prior to granting them access to information or information technology resources.

All units must follow personnel security practices as listed in:

• Policy HR-02-10 (Background Checks)
• Policy PS-01 (Programs Involving Children) (if applicable)

Notes

For affiliate users: “Sponsors should weigh the risks of an affiliated user causing harm through inappropriate use of IU information technology resources against the benefits of the user having access. Sponsors are responsible for taking steps to reduce the likelihood of inappropriate use (including appropriate user training). Additionally, prior to requesting the account, the sponsor and the person being sponsored should have a written agreement defining the terms of the affiliation relationship. Any written agreement must comply with university policy FIN-TRE-VI-100, Signature Authority and Delegation. Sponsors should consult with their department or unit on how best to document the user's affiliation with and responsibilities to both IU and the sponsor's department or unit.” (Policy IT-03 (Eligibility to Use IT Resources)

NIST Cross Reference

PS-3

Control:

Personnel Termination

Required for:

High

Moderate

Low

IU Implementation

• When an employee is terminated, their credentials and authenticators must be revoked within a timeframe appropriate to the risks involved.
• If an employee is terminated for cause, an accelerated timeline for revoking access must be considered to reduce risk.
• Terminated employee access/authorizations to information technology resources must be removed.
• Units must retrieve all security-related organizational information or system-related property from terminated employees and inform the appropriate personnel of these changes.

Notes

When an employee is terminated, the employee’s designated IT Staff or Fiscal Officer must follow any unit exit procedures, which could include such steps as:

1. Reviewing Active Directory group memberships and making necessary changes.
2. Reviewing access to institutional systems and making changes as appropriate.
3. Updating device registrations assigned to the individual (see MAS Tools, Windows Device Management, Apple Device Management).
4. Wiping old devices assigned to the individual (see Data Removal, Erasing Solid State Drives, Securely wipe disk drives, Remove institutional data from your mobile device if no longer using it).
5. Reassigning group accounts and affiliate sponsorships.
6. Updating recurring meetings scheduled by the individual.
7. Reviewing folders, files, and resources such as online forms and workflows owned by the user in institutional storage locations and transitioning to new ownership as needed.
8. Collecting university-owned hardware.
9. Asking the departing employee to back up all personal data they want to retain from sources such as departmental storage drives, cloud storage, Canvas, and email prior to account expiration.

NIST Cross Reference

PS-4

Control:

Personnel Transfer

Required for:

High

Moderate

Low

IU Implementation

When an employee is transferred, the employee’s former unit must review that employee’s access to information systems and remove, add, or modify access as appropriate.

Notes

It is recommended that the employee’s former unit coordinate with the new unit during this process.

NIST Cross Reference

PS-5

Control:

Access Agreements

Required for:

High

Moderate

Low

IU Implementation

All users must assent to the IU Acceptable Use Agreement during initial account creation and re-assent every two years thereafter for continued access.

Users may be required to assent to additional agreements to meet legal and regulatory requirements that may apply to specific information technology resources.

Notes

The Acceptable Use Agreement requirement is met automatically for centrally provisioned accounts.

See also:

• Acceptable Use Agreement
• Verify Acceptable Use Agreement
• Control PL-4 in the Planning Standard

NIST Cross Reference

PS-6

Control:

Personnel Sanctions

Required for:

High

Moderate

Low

IU Implementation

Users who violate university information technology policies associated with the use of IT resources at Indiana University may be subject to formal sanctions.

Notes

Users of IT resources at Indiana University are subject to sanctions as listed in the “Sanctions” section of the respective policies and as described in Policy IT-02 (Misuse and Abuse of Information Technology) when they have violated existing laws or university procedures, including but not limited to:

• University Information Technology Policies;
• Code of Student Rights, Responsibilities, and Conduct;
• Academic, Faculty, and Student policies;
• University Human Resources Policies; and
• University Financial Policies.

Users of IT resources who have otherwise violated generally accepted ethical norms and principles may also be subject to such sanctions.

NIST Cross Reference

PS-8